ASEC reports that Larva-25004, a cluster related to Kimsuky activity, used malware signed with a Nexaweb Inc. certificate. Two SCR files, including a job-description-themed sample, were signed in May 2024 with certificate serial 0315e137a6e2d658f07af454c63a0af2. Execution displays an employment-related PDF lure, and ASEC assesses from the bait content that the likely audience may include people interested in defense-company jobs. The certificate observed on these two malware files was not found signing other files in ASEC's review, while a previously used Nexaweb certificate did not show malware in the checked set.